paxton
/
mailcow
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #3002 from ntimo/task/api-status-codes 

[API] Status Codes and only allow valid http method
master
André Peters 2019-10-09 22:22:06 +02:00 committed by GitHub
parent 1f0316064b af13ae455c
commit 7373d91724
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 89 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

91
data/web/json_api.php
View File

@ -69,6 +69,7 @@ if (isset($_SESSION['mailcow_cc_role']) || isset($_SESSION['pending_mailcow_cc_u
// check for valid json // check for valid json
if ($action != 'get' && $requestDecoded === null) { if ($action != 'get' && $requestDecoded === null) {
http_response_code(400);
echo json_encode(array( echo json_encode(array(
'type' => 'error', 'type' => 'error',
'msg' => 'Request body doesn\'t contain valid json!' 'msg' => 'Request body doesn\'t contain valid json!'
@ -126,6 +127,15 @@ if (isset($_SESSION['mailcow_cc_role']) || isset($_SESSION['pending_mailcow_cc_u
$attr = (array)json_decode($_POST['attr'], true); $attr = (array)json_decode($_POST['attr'], true);
unset($attr['csrf_token']); unset($attr['csrf_token']);
} }
// only allow POST requests to POST API endpoints
if ($_SERVER['REQUEST_METHOD'] != 'POST') {
http_response_code(405);
echo json_encode(array(
'type' => 'error',
'msg' => 'only POST method is allowed'
));
exit();
}
switch ($category) { switch ($category) {
case "time_limited_alias": case "time_limited_alias":
process_add_return(mailbox('add', 'time_limited_alias', $attr)); process_add_return(mailbox('add', 'time_limited_alias', $attr));
@ -196,12 +206,29 @@ if (isset($_SESSION['mailcow_cc_role']) || isset($_SESSION['pending_mailcow_cc_u
case "tls-policy-map": case "tls-policy-map":
process_add_return(tls_policy_maps('add', $attr)); process_add_return(tls_policy_maps('add', $attr));
break; break;
// return no route found if no case is matched
default:
http_response_code(404);
echo json_encode(array(
'type' => 'error',
'msg' => 'route not found'
));
exit();
} }
break; break;
case "get": case "get":
function process_get_return($data) { function process_get_return($data) {
echo (!isset($data) || empty($data)) ? '{}' : json_encode($data, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT); echo (!isset($data) || empty($data)) ? '{}' : json_encode($data, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT);
} }
// only allow GET requests to GET API endpoints
if ($_SERVER['REQUEST_METHOD'] != 'GET') {
http_response_code(405);
echo json_encode(array(
'type' => 'error',
'msg' => 'only GET method is allowed'
));
exit();
}
switch ($category) { switch ($category) {
case "rspamd": case "rspamd":
switch ($object) { switch ($object) {
@ -561,6 +588,14 @@ if (isset($_SESSION['mailcow_cc_role']) || isset($_SESSION['pending_mailcow_cc_u
} }
echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}'; echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}';
break; break;
// return no route found if no case is matched
default:
http_response_code(404);
echo json_encode(array(
'type' => 'error',
'msg' => 'route not found'
));
exit();
} }
break; break;
case "mailbox": case "mailbox":
@ -1026,9 +1061,14 @@ if (isset($_SESSION['mailcow_cc_role']) || isset($_SESSION['pending_mailcow_cc_u
break; break;
} }
break; break;
// return no route found if no case is matched
default: default:
echo '{}'; http_response_code(404);
break; echo json_encode(array(
'type' => 'error',
'msg' => 'route not found'
));
exit();
} }
break; break;
case "delete": case "delete":
@ -1055,6 +1095,15 @@ if (isset($_SESSION['mailcow_cc_role']) || isset($_SESSION['pending_mailcow_cc_u
else { else {
$items = (array)json_decode($_POST['items'], true); $items = (array)json_decode($_POST['items'], true);
} }
// only allow POST requests to POST API endpoints
if ($_SERVER['REQUEST_METHOD'] != 'POST') {
http_response_code(405);
echo json_encode(array(
'type' => 'error',
'msg' => 'only POST method is allowed'
));
exit();
}
switch ($category) { switch ($category) {
case "alias": case "alias":
process_delete_return(mailbox('delete', 'alias', array('id' => $items))); process_delete_return(mailbox('delete', 'alias', array('id' => $items)));
@ -1135,6 +1184,14 @@ if (isset($_SESSION['mailcow_cc_role']) || isset($_SESSION['pending_mailcow_cc_u
case "rlhash": case "rlhash":
echo ratelimit('delete', null, implode($items)); echo ratelimit('delete', null, implode($items));
break; break;
// return no route found if no case is matched
default:
http_response_code(404);
echo json_encode(array(
'type' => 'error',
'msg' => 'route not found'
));
exit();
} }
break; break;
case "edit": case "edit":
@ -1163,6 +1220,15 @@ if (isset($_SESSION['mailcow_cc_role']) || isset($_SESSION['pending_mailcow_cc_u
unset($attr['csrf_token']); unset($attr['csrf_token']);
$items = isset($_POST['items']) ? (array)json_decode($_POST['items'], true) : null; $items = isset($_POST['items']) ? (array)json_decode($_POST['items'], true) : null;
} }
// only allow POST requests to POST API endpoints
if ($_SERVER['REQUEST_METHOD'] != 'POST') {
http_response_code(405);
echo json_encode(array(
'type' => 'error',
'msg' => 'only POST method is allowed'
));
exit();
}
switch ($category) { switch ($category) {
case "bcc": case "bcc":
process_edit_return(bcc('edit', array_merge(array('id' => $items), $attr))); process_edit_return(bcc('edit', array_merge(array('id' => $items), $attr)));
@ -1271,8 +1337,29 @@ if (isset($_SESSION['mailcow_cc_role']) || isset($_SESSION['pending_mailcow_cc_u
process_edit_return(edit_user_account($attr)); process_edit_return(edit_user_account($attr));
} }
break; break;
// return no route found if no case is matched
default:
http_response_code(404);
echo json_encode(array(
'type' => 'error',
'msg' => 'route not found'
));
exit();
} }
break; break;
// return no route found if no case is matched
default:
http_response_code(404);
echo json_encode(array(
'type' => 'error',
'msg' => 'route not found'
));
exit();
}
}
if ($_SESSION['mailcow_cc_api'] === true) {
if (isset($_SESSION['mailcow_cc_api']) && $_SESSION['mailcow_cc_api'] === true) {
unset($_SESSION['return']);
} }
} }
} }